[CLSA-2026:1793357095] acl: Fix of CVE-2026-54370
Type:
security
Severity:
Important
Release date:
2026-10-30 10:45:06 UTC
Description:
- CVE-2026-54370: getfacl, setfacl (incl. --restore) and chacl followed attacker-planted symlinks during tree walks (TOCTOU), allowing ACL/mode changes on unintended files
CVEs fixed:
Updated packages:
  • acl-2.2.51-14.amzn2.0.1.tuxcare.els1.aarch64.rpm
    sha:7b075af1542087e26e5de8c0e887b0c243e440dc7027e8c7a6b7ff23f2c106fe
  • acl-2.2.51-14.amzn2.0.1.tuxcare.els1.i686.rpm
    sha:5a216b98c53082f0362ba98eb6a8fc82072d25f48b2f7dbbcdbb53db1510cb2b
  • acl-2.2.51-14.amzn2.0.1.tuxcare.els1.x86_64.rpm
    sha:258d1163701280e519ec9d5486a8ad31f049c6d3185f523bd14dbbab5b60475d
  • libacl-2.2.51-14.amzn2.0.1.tuxcare.els1.aarch64.rpm
    sha:1b726c2058274977d81f8822c749c37a7d4d3d998046caddce3922d3961d322c
  • libacl-2.2.51-14.amzn2.0.1.tuxcare.els1.i686.rpm
    sha:4cf512c4c0544d17a4eb2cda6c5a1718105763801e021164d90e69f372beab13
  • libacl-2.2.51-14.amzn2.0.1.tuxcare.els1.x86_64.rpm
    sha:18e87f9133fbc927f2393ea5dc56f7cfd45c361be2f357c311507ddd15088b2e
  • libacl-devel-2.2.51-14.amzn2.0.1.tuxcare.els1.aarch64.rpm
    sha:aec10f94a1e1c1700356cd592238505d6b0caf429c8001c3fc76a49cdda01172
  • libacl-devel-2.2.51-14.amzn2.0.1.tuxcare.els1.i686.rpm
    sha:7e06c529aeb5eff7804fe7bd3137127cd283b33c550d8cffff6e3774f7107e02
  • libacl-devel-2.2.51-14.amzn2.0.1.tuxcare.els1.x86_64.rpm
    sha:9223b52bb1cf45ea5428addb624a84bb35396e32d47657f48e0f31ec6b6c37c0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.